Azure Front Door vs Traffic Manager: Request Handling

Azure Front Door and Azure Traffic Manager both route incoming requests to your backends, but they work at different layers of the network stack, which changes how they handle each request. Front Door operates at Layer 7 (HTTP/HTTPS) and can inspect, modify, and route individual web requests based on URL paths, headers, and cookies, while Traffic Manager works at the DNS level (Layer 3/4) and only answers DNS queries with a chosen backend IP, after which all traffic flows directly from the client to that backend. This fundamental difference drives everything else: Front Door is a full application delivery controller with caching, WAF, and TLS offload, whereas Traffic Manager is a DNS-based global load balancer that does not see or alter any of the actual request traffic.

Background: What Each Service Was Built For

Azure Traffic Manager was introduced in 2013 as a DNS-based traffic router. Its job is to answer the question “which endpoint should this client connect to?” by returning an IP address (or a CNAME) in the DNS response. Because it operates at DNS, it can route based on geographic location, endpoint health, or performance, but once the client gets the IP, the connection goes directly to that endpoint—Traffic Manager is not in the path.

Azure Front Door launched in 2019 as a modern Content Delivery Network (CDN) and application firewall. It is a reverse proxy that terminates the client’s TLS connection, inspects the HTTP request, and then forwards it to the best backend based on URL path, headers, or other Layer 7 attributes. It can also cache static content, compress responses, and apply WAF rules. This makes it a much richer tool for web applications that need fine-grained control over how requests are handled.

How Request Handling Differs: DNS vs Proxy

The most important distinction is the request path. With Traffic Manager, the client performs a DNS lookup, gets an IP, and then connects directly to that IP. The request never passes through Traffic Manager. With Front Door, the client connects to a Front Door edge (a Microsoft-managed IP), and Front Door establishes a separate connection to the backend. This means:

• Traffic Manager sees only DNS queries, not HTTP requests. It cannot inspect headers, cookies, or URL paths.
• Front Door sees every HTTP request and can route based on any part of it, including path, query string, and headers.
• Traffic Manager cannot cache content, because it never sees the content.
• Front Door can cache static assets at the edge, reducing load on backends.
• Traffic Manager cannot offload TLS, because it doesn’t terminate the connection.
• Front Door terminates TLS at the edge, so backends can use HTTP internally.

Routing Methods: How Each Picks a Backend

Traffic Manager offers several routing methods, all based on DNS:

• Priority: Always use the primary endpoint unless it’s unhealthy, then fail over to the next.
• Weighted: Distribute traffic across endpoints according to assigned weights (e.g., 70% to one, 30% to another).
• Performance: Route to the endpoint with the lowest network latency from the client’s location.
• Geographic: Route based on the client’s geographic region (e.g., all European users to a European endpoint).
• MultiValue: Return multiple healthy endpoints in the DNS response; the client picks one.
• Subnet: Route based on the client’s IP subnet (used for specific IP ranges).

Front Door also has routing methods, but they are more granular:

• Path-based: Route /api/* to one backend pool and /images/* to another.
• Header-based: Route based on a specific HTTP header (e.g., a version header).
• Query-string-based: Route based on the query string (e.g., ?platform=mobile).

Front Door also supports health probes that check the actual HTTP endpoint, whereas Traffic Manager health checks are simpler (HTTP/HTTPS GET or TCP) and only affect DNS responses, not the request path.

Common Problems and Misconceptions

One frequent misunderstanding is that Traffic Manager can do path-based routing—it cannot. Since it only answers DNS queries, it has no idea what path the client will request. If you need to route /api to one server and /web to another, you must use Front Door (or another Layer 7 load balancer).

Another issue is session affinity. Traffic Manager does not support sticky sessions because it doesn’t see the request—once the client has the IP, it’s on its own. Front Door supports session affinity by setting a cookie, so subsequent requests from the same client go to the same backend.

Also, be aware of DNS caching. Traffic Manager relies on the TTL (time-to-live) of DNS records. If you change routing, clients may still use the old IP until the TTL expires (commonly 300 seconds). Front Door changes propagate almost instantly because the client connects to Front Door’s IP, not to the backend IP.

How to Choose Between Them

Use Traffic Manager when:

• You need to route traffic at the DNS level for non-HTTP protocols (e.g., FTP, RDP, or custom TCP/UDP services).
• You want a simple global load balancer without the overhead of a proxy.
• You have a legacy application that cannot handle a reverse proxy (e.g., it checks client IPs).
• You need to spread traffic across multiple regions, but each region has its own load balancer.

Use Front Door when:

• You have an HTTP/HTTPS web application that needs path-based routing, caching, or WAF.
• You want to offload TLS and reduce backend load.
• You need to modify requests or responses (e.g., rewrite URLs, add headers).
• You want to protect your origin servers by hiding their IPs.

Costs and Performance Considerations

Traffic Manager is relatively inexpensive because it only processes DNS queries. You pay per million DNS queries, plus a small monthly fee per endpoint. Front Door has a more complex pricing model: you pay for data transfer (GB), requests (per 10,000), and additional features like WAF rules and managed rule sets. For high-traffic sites, Front Door can become significantly more expensive than Traffic Manager, but it provides more value.

Performance-wise, Front Door adds a network hop (client → edge → backend), which can increase latency by a few milliseconds, but it also offers connection multiplexing and TLS optimization. Traffic Manager adds zero proxy latency because the client connects directly to the backend, but the DNS lookup itself can take 10-50 ms depending on caching. For most web applications, the difference is negligible.

Alternatives and Related Services

Azure also offers Application Gateway, which is a regional Layer 7 load balancer (not global). If you need path-based routing but only within a single region, Application Gateway is often cheaper than Front Door. For global HTTP load balancing with caching, you could also consider Azure CDN with dynamic site acceleration, but Front Door is the more integrated solution.

Another alternative is to use Traffic Manager in front of Application Gateway instances to combine global DNS routing with regional Layer 7 routing. This is a common architecture for enterprises that need both.

Frequently Asked Questions

Can Traffic Manager do URL path-based routing?

No. Traffic Manager operates at DNS, so it cannot see the URL path. It only knows the client’s IP and the DNS query. For path-based routing, you need a Layer 7 load balancer like Front Door or Application Gateway.

Does Front Door support WebSocket?

Yes, Front Door supports WebSocket connections. It will forward the WebSocket handshake and then tunnel the bidirectional data. Traffic Manager also supports WebSocket because it doesn’t interfere with the connection—it just provides the IP.

Can I use both Traffic Manager and Front Door together?

Yes. A common pattern is to use Traffic Manager to route between multiple Front Door instances (or between Front Door and another CDN) for multi-cloud or multi-vendor scenarios. However, for most Azure-only setups, you would just use Front Door alone.

Which one is better for global load balancing?

If you only need to distribute traffic across regions at the DNS level, Traffic Manager is simpler and cheaper. If you need HTTP-level features like caching, WAF, or path-based routing, Front Door is better. For pure global load balancing of non-HTTP protocols, Traffic Manager is the only option.

Does Traffic Manager hide my origin server IP?

No. Traffic Manager returns the actual IP of your backend endpoints in DNS responses. If you want to hide your origin IP, you need a reverse proxy like Front Door, which masks the backend IP.

Related

• Steam Kit for Kids: What to Look For
• Batman Arkham City vs Arkham Knight Combat Story Open World
• Slumber by Blossoms Makeup Crafting Recipes in Infinity Nikki